Sessions are stored only in this browser's local storage on this device. It is not encrypted, not shared with other devices and can be wiped by clearing browser data or private browsing. Export JSON regularly for safekeeping and avoid storing sensitive customer data.